kevinveenbirkenbachandClaude Opus 5
33504a3b7b
Resolved 35 conflicts per the designer x store-i18n checklist: store-i18n stays the single point of truth for credentials and role logic, designer's verified design work is kept. Credential convergers: store-i18n's realign contract wins where both sides have one (mediawiki realign_admin_password.sh over converge_admin.php, pgadmin realign over administrator.yml, matomo utils/converge_superuser.yml over 09_admin_password.yml); the designer-only ones with no counterpart stay. READMEs: test_readme.py hard-fails a committed Quick Setup or Credits block, both of which designer's side carries, so those go and only the Further Resources heading rename and the gallery links remain. SuiteCRM takes main's session fix, leaving exactly one SUITECRM_SESSION_CONFIG_HOST and dropping the Symfony cache-rebuild task the entrypoint now covers. Two defects the rename detection hid: git paired store-i18n's web-app-meta against designer's web-app-sphinx, so sphinx's design slots would have been lost and its require(./test-design) landed in web-app-meta, whose spec has no such file. The sphinx design spec and its require now sit in web-app-docs, the role store-i18n renamed sphinx to. Designer's eleven new Playwright design specs read env with || "" defaults, which test_unguarded_env_default.py refuses because an empty string matches every substring assertion; 35 bindings now go through requireDotenvValue. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.1 KiB
PhpMyAdmin
Description
This Ansible role deploys PhpMyAdmin in a secure Docker environment, complete with optional OAuth2 proxy support. It enables seamless management of MariaDB/MySQL databases via a web-app-based interface.
Overview
The role configures and deploys a containerized PhpMyAdmin instance using Docker Compose. It optionally integrates with a central database and uses dynamic Ansible variables to support flexible deployments in both production and homelab environments.
Purpose
The purpose of this role is to provide a reliable, configurable, and secure PhpMyAdmin deployment out-of-the-box. It minimizes the need for manual setup, and integrates smoothly with other Infinito.Nexus infrastructure roles.
Features
- Docker Compose Integration: Deploy PhpMyAdmin via a templated Compose setup.
- OAuth2 Proxy Support: Secure your admin interface with modern authentication.
- Central DB Integration: Connects to shared MariaDB instances for multi-role environments.
- Custom Configuration: Leverage Ansible variables to fine-tune your deployment.
- Healthchecks & Networking: Includes Docker healthchecks and network setup logic.
Persona contract opt-outs
phpMyAdmin signs in as the MariaDB root account wired through PMA_USER / PMA_PASSWORD (templates/env.j2, vars/main.yml); the Keycloak administrator username is not a MariaDB user, so in the services.sso.enabled: false matrix variants the administrator persona has no native login to drive and templates/playwright.env.j2 renders PERSONA_ADMINISTRATOR_BLOCKED=true. meta/services.yml admits only the web-app-phpmyadmin administrator RBAC group to the oauth2-proxy (sso.oauth2.allowed_groups) and biber carries an empty role list, so PERSONA_BIBER_BLOCKED=true holds in every variant. The guest persona and the baseline assertions run unconditionally.